Characters before a CSS background url function

This vector shows which characters are allowed before the CSS url() function.

Shazzer Master

Created Aug 6, 2026

Updated Aug 6, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div id=x style="background:$[chr]url(/foo)">test</div>0x0D

Code used after fuzz:

window.getComputedStyle(x).backgroundImage !== 'none' && log($[i])

Sample payloads

<div id=x style="background:⟦09⟧url(/foo)">test</div>0x0D

<div id=x style="background:
url(/foo)">test</div>0x0D

<div id=x style="background:⟦0C⟧url(/foo)">test</div>0x0D

<div id=x style="background:⟦0D⟧url(/foo)">test</div>0x0D

<div id=x style="background: url(/foo)">test</div>0x0D

<div id=x style="background:\url(/foo)">test</div>0x0D